// ❌ 危险：web.ignoring() 将路径完全移出安全过滤器链
// 该路径上所有安全机制（认证、授权、CSRF、Session 管理等）全部失效
@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return web -> web.ignoring()
        .requestMatchers("/api/public/**", "/actuator/health");
}

// ✅ 正确：permitAll() 仅跳过认证，仍保留 CSRF、Session 等安全机制
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/api/public/**").permitAll()
        .anyRequest().authenticated()
    );
    return http.build();
}

// ❌ 危险：宽泛的匹配优先于精细匹配
@Bean
@Order(1)
public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/**")  // 匹配所有 /api/
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
    return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain adminFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/admin/**")  // 永远不会生效！
        .authorizeHttpRequests(auth -> auth.anyRequest().hasRole("ADMIN"));
    return http.build();
}

// ❌ 如果忘记启用方法级安全，所有 @PreAuthorize 注解都会被忽略！

// Spring Security 6.x 需要：
@EnableMethodSecurity  // ← 新 API

// Spring Security 5.x 需要：
@EnableGlobalMethodSecurity(prePostEnabled = true)  // ← 旧 API

// 两者功能等价，但注解名不同。如果 @PreAuthorize 生效了但你没找到
// @EnableMethodSecurity，去搜索 @EnableGlobalMethodSecurity —
// 它可能藏在父配置类、其他模块、或 XML 里。

// 以下两个密码在 BCrypt 眼中是"相同"的（前72字符一致）
String pass1 = "a".repeat(72) + "rest_of_password_1";
String pass2 = "a".repeat(72) + "rest_of_password_2";
// BCryptPasswordEncoder.matches() 会错误地返回 true！

// ❌ 危险（Spring Security < 修复版本）
http.authorizeHttpRequests(auth -> auth
    .requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll()
    // 如果 HealthEndpoint 被禁用，这会匹配 /null/** → 放行大量路径
    .anyRequest().authenticated()
);

// ❌ 危险：允许所有来源
@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowedOrigins(Arrays.asList("*"));       // 允许任意来源
    config.setAllowedMethods(Arrays.asList("*"));       // 允许任意方法
    config.setAllowCredentials(true);                   // 允许携带凭证
    return new UrlBasedCorsConfigurationSource();
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity  // 必须显式启用
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/actuator/**").hasRole("MONITORING")
                .anyRequest().authenticated()
            )
            .requiresChannel(channel -> channel.anyRequest().requiresSecure())
            .formLogin(form -> form.defaultSuccessUrl("/"))
            .sessionManagement(session -> session
                .sessionFixation().migrateSession()
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
            )
            .headers(headers -> headers
                .xssProtection(xss -> xss.headerValue(XXssProtectionHeaderWriter
                    .HeaderValue.ENABLED_MODE_BLOCK))
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'"))
            );

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
}

// ① hasRole("ADMIN") — 自动加前缀 ROLE_
@PreAuthorize("hasRole('ADMIN')")

// ② hasAuthority('circle:admin:list') — 精确匹配
@PreAuthorize("hasAuthority('circle:admin:list')")

// ③ hasPermission(target, permission) — 需自定义 PermissionEvaluator
@PreAuthorize("hasPermission(#orderId, 'ORDER', 'READ')")

@Service
public class UserDetailsServiceImpl implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) {
        User user = userMapper.findByUsername(username);
        List<String> permissions = permissionMapper.findByUserId(user.getId());
        
        List<SimpleGrantedAuthority> authorities = permissions.stream()
            .map(SimpleGrantedAuthority::new)  // ← 不做任何前缀处理
            .collect(Collectors.toList());
        
        return new User(user.getUsername(), user.getPassword(),
            user.getEnabled(), true, true, true, authorities);
    }
}

// Controller 中使用
@PreAuthorize("hasAuthority('circle:admin:list')")
@GetMapping("/list")
public CommonResult<CommonPage<SystemAdminResponse>> getList(...) { }

// SpEL 组合条件
@PreAuthorize("hasAuthority('circle:admin:add') or hasAuthority('circle:super:add')")
@PostMapping("/add")
public CommonResult<Void> addAdmin(...) { }

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {
    @Autowired private OrderService orderService;
    
    @Override
    public boolean hasPermission(Authentication auth, Object targetId,
                                  Object targetType, Object permission) {
        Long orderId = (Long) targetId;
        String username = auth.getName();
        Long userId = userService.getUserId(username);
        Order order = orderService.findById(orderId);
        return order != null && order.getUserId().equals(userId);
    }
}

// URL 层：粗粒度角色检查
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/admin/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_SUPER_ADMIN")
    .anyRequest().authenticated()
);

// 方法层：细粒度权限检查
@PreAuthorize("hasAuthority('circle:admin:list')")
@GetMapping("/list")
public CommonResult<?> list() { ... }

// ✅ 分离配置：浏览器页面保留 CSRF，纯 API 可以关闭
@Bean
@Order(1)
public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/**")
        .csrf(csrf -> csrf.disable())  // API 用 Token 认证，无 CSRF 风险
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        // ... JWT 配置
    return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain webFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/admin/**", "/user/**")
        // 保留 CSRF 防护 — 页面使用 Cookie/Session
        .csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
        )
        // ...
    return http.build();
}

// ✅ Spring Security 作为 OAuth2 Resource Server
@Bean
public SecurityFilterChain resourceServerFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/public/**").permitAll()
            .requestMatchers("/api/admin/**").hasAuthority("SCOPE_admin")
            .anyRequest().authenticated()
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(jwt -> jwt
                .decoder(jwtDecoder())
                .jwtAuthenticationConverter(jwtAuthConverter())
            )
        )
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
}

@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder
        .withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
        .jwsAlgorithm(JWSAlgorithm.RS256)  // 严格指定算法
        .build();
}

// 将 JWT claims 中的自定义字段映射为 GrantedAuthority
@Bean
public JwtAuthenticationConverter jwtAuthConverter() {
    JwtGrantedAuthoritiesConverter converter = new JwtGrantedAuthoritiesConverter();
    converter.setAuthorityPrefix("");  // 不加 SCOPE_ 前缀
    converter.setAuthoritiesClaimName("permissions");  // 从 permissions claim 读取
    
    JwtAuthenticationConverter authConverter = new JwtAuthenticationConverter();
    authConverter.setJwtGrantedAuthoritiesConverter(converter);
    return authConverter;
}

// 实战示例：检查参数归属
@PreAuthorize("#order.userId == authentication.principal.id")
@GetMapping("/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId) { }

// 调用自定义 Service 方法
@PreAuthorize("@rbacService.canAccessProject(#projectId)")
@GetMapping("/projects/{projectId}")
public Project getProject(@PathVariable Long projectId) { }

@SpringBootTest
@AutoConfigureMockMvc
class CircleAdminControllerTest {

    @Autowired
    private MockMvc mockMvc;

    // ✅ 模拟有 ADMIN 角色的用户
    @Test
    @WithMockUser(roles = "ADMIN")
    void adminCanAccessAdminEndpoint() throws Exception {
        mockMvc.perform(get("/api/admin/circle/list"))
            .andExpect(status().isOk());
    }

    // ✅ 模拟普通用户 — 期望 403
    @Test
    @WithMockUser(roles = "USER")
    void normalUserCannotAccessAdminEndpoint() throws Exception {
        mockMvc.perform(get("/api/admin/circle/list"))
            .andExpect(status().isForbidden());
    }

    // ✅ 模拟未登录 — 期望 401
    @Test
    void unauthenticatedUserGets401() throws Exception {
        mockMvc.perform(get("/api/admin/circle/list"))
            .andExpect(status().isUnauthorized());
    }

    // ✅ 自定义权限的测试注解
    @Test
    @WithMockUser(authorities = "circle:admin:list")
    void userWithSpecificPermissionCanAccess() throws Exception {
        mockMvc.perform(get("/api/admin/circle/list"))
            .andExpect(status().isOk());
    }
    
    // ✅ 测试 @PreAuthorize 注解是否真实生效（防静默失效）
    @Test
    @WithMockUser(authorities = "circle:user:list")  // 无 admin 权限
    void userWithoutPermissionGets403() throws Exception {
        mockMvc.perform(get("/api/admin/circle/list"))
            .andExpect(status().isForbidden());
    }
}

// ── Spring Security 5.x（旧，WebSecurityConfigurerAdapter 已废弃）──
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/api/public/**").permitAll()
            .antMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
            .and()
            .formLogin();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());
    }
}

// ── Spring Security 6.x（新，Lambda DSL + Bean 方式）──
@Configuration
@EnableWebSecurity
@EnableMethodSecurity  // ← 改名了
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth    // ← authorizeHttpRequests
                .requestMatchers("/api/public/**").permitAll()  // ← requestMatchers
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() { ... }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
}

// 你现在的代码（Spring Security 5.x）
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    // 这就是 @PreAuthorize 生效的原因 ——
    // prePostEnabled=true 开启了方法级安全，
    // 但不是 @EnableMethodSecurity，而是 @EnableGlobalMethodSecurity
}

// ❌ 登录前后 Session ID 不变
http.sessionManagement().sessionFixation().none();

// ✅ 登录后更换 Session ID
http.sessionManagement()
    .sessionFixation().migrateSession();  // 创建新 Session，复制属性
// 或
http.sessionManagement()
    .sessionFixation().newSession();      // 创建全新 Session

@Bean
public CookieSerializer cookieSerializer() {
    DefaultCookieSerializer serializer = new DefaultCookieSerializer();
    serializer.setSameSite("Strict");
    serializer.setUseSecureCookie(true);
    serializer.setUseHttpOnlyCookie(true);
    return serializer;
}

// ❌ 只判断 getAttribute 是否为 null，无状态校验
Object user = session.getAttribute("user");
if (user == null) { response.sendRedirect("/login"); return false; }
return true;  // 不管 user 是否已被禁用、IP 是否变化

@Component
public class SessionAuthInterceptor implements HandlerInterceptor {
    @Autowired private RedisTemplate<String, SessionUser> redis;
    @Autowired private UserService userService;
    
    public boolean preHandle(HttpServletRequest request, ...) {
        String sessionId = request.getHeader("X-Session-Id");
        if (sessionId == null) {
            HttpSession s = request.getSession(false);
            if (s == null) { respond401(response, "未登录"); return false; }
            sessionId = s.getId();
        }
        
        SessionUser user = redis.opsForValue().get("session:user:" + sessionId);
        if (user == null) { respond401(response, "Session 过期"); return false; }
        
        // 检查用户是否仍有效（可能被管理员禁用）
        if (!userService.isUserActive(user.getUserId())) {
            redis.delete("session:user:" + sessionId);
            respond401(response, "账号已禁用"); return false;
        }
        
        // 检查 IP 变化（管理后台推荐严格模式）
        String currentIp = getClientIp(request);
        if (!currentIp.equals(user.getLoginIp())) {
            log.warn("IP变化: userId={}", user.getUserId());
        }
        
        // 续期
        redis.expire("session:user:" + sessionId, Duration.ofMinutes(30));
        request.setAttribute("currentUser", user);
        return true;
    }
}

@Data
public class SessionUser implements Serializable {
    private Long userId;
    private String username;
    private Set<String> roles;
    private Set<String> permissions;
    private String loginIp;
    private String userAgent;
    private LocalDateTime loginTime;
}

@Override
public boolean preHandle(HttpServletRequest request, ...) {
    String token = extractBearerToken(request);
    if (token == null) { respond401(response, "缺少Token"); return false; }
    
    // 黑名单检查（已注销的 Token）
    if (Boolean.TRUE.equals(redis.hasKey("token:blacklist:" + getTokenId(token)))) {
        respond401(response, "Token 已失效"); return false;
    }
    
    // JWT 校验
    try {
        TokenUser user = jwtService.validateAndParse(token);
        request.setAttribute("currentUser", user);
        return true;
    } catch (JwtException e) {
        respond401(response, "Token 无效"); return false;
    }
}

// ❌ 缓存无失效机制 — 权限变更后旧权限仍生效
public Set<String> getUserPermissions(Long userId) {
    Set<String> cached = redis.opsForValue().get("perm:" + userId);
    if (cached != null) return cached;  // ← 永远返回缓存
    // ...
}

// ✅ 变更时主动失效 + 短 TTL
public void updateUserPermissions(Long userId, Set<String> newPerms) {
    permissionMapper.updatePermissions(userId, newPerms);
    redis.delete("perm:" + userId);  // 立即失效
    redis.convertAndSend("perm:invalidate", userId.toString());  // 通知其他节点
}

public Set<String> getUserPermissions(Long userId) {
    return Optional.ofNullable(redis.opsForValue().get("perm:" + userId))
        .orElseGet(() -> {
            Set<String> perms = permissionMapper.findByUserId(userId);
            redis.opsForValue().set("perm:" + userId, perms, Duration.ofMinutes(5));
            return perms;
        });
}

@Component
public class SessionManager {
    @Autowired private RedisTemplate<String, String> redis;
    
    public void registerSession(Long userId, String newSessionId) {
        String oldSessionId = redis.opsForValue().get("user:session:" + userId);
        if (oldSessionId != null && !oldSessionId.equals(newSessionId)) {
            redis.opsForValue().set("session:blacklist:" + oldSessionId, "kicked", 
                Duration.ofMinutes(30));
            log.info("用户 {} 新设备登录，旧 Session 被踢出", userId);
        }
        redis.opsForValue().set("user:session:" + userId, newSessionId, 
            Duration.ofHours(2));
    }
}

@Component
public class LoginRateLimiter {
    private static final int MAX_ATTEMPTS = 5;
    private static final Duration WINDOW = Duration.ofMinutes(5);
    private static final Duration BLOCK = Duration.ofMinutes(15);
    
    public boolean isBlocked(String username, String ip) {
        return Boolean.TRUE.equals(redis.hasKey("login:block:" + ip))
            || Boolean.TRUE.equals(redis.hasKey("login:block:user:" + username));
    }
    
    public void recordFailedAttempt(String username, String ip) {
        String key = "login:attempt:" + ip + ":" + username;
        Long attempts = redis.opsForValue().increment(key);
        if (attempts == 1) redis.expire(key, WINDOW);
        if (attempts >= MAX_ATTEMPTS) {
            redis.opsForValue().set("login:block:" + ip, 1, BLOCK);
            redis.opsForValue().set("login:block:user:" + username, 1, BLOCK);
        }
    }
}

// 管理后台：Session
@Bean
public SecurityFilterChain webChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/admin/**")
        .authorizeHttpRequests(a -> a.anyRequest().hasRole("ADMIN"))
        .formLogin(Customizer.withDefaults())
        .sessionManagement(s -> s.sessionCreationPolicy(IF_REQUIRED));
    return http.build();
}

// API：JWT
@Bean @Order(1)
public SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/**")
        .authorizeHttpRequests(a -> a.requestMatchers("/api/public/**").permitAll()
            .anyRequest().authenticated())
        .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
        .sessionManagement(s -> s.sessionCreationPolicy(STATELESS));
    return http.build();
}

@Configuration
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 1800)
public class SessionConfig {

    @Bean
    public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
        // 不要用 JdkSerializationRedisSerializer — 有反序列化风险
        // 推荐 Jackson 或 GenericJackson2JsonRedisSerializer
        return new GenericJackson2JsonRedisSerializer();
    }

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setCookieName("SESSIONID");
        serializer.setCookiePath("/");
        serializer.setDomainNamePattern("^.+?\\.(example\\.com)$");
        serializer.setUseSecureCookie(true);
        serializer.setUseHttpOnlyCookie(true);
        serializer.setSameSite("Lax");
        return serializer;
    }

    @Bean
    public RedisIndexedSessionRepository sessionRepository(
            RedisOperations<String, Object> redis) {
        RedisIndexedSessionRepository repo = 
            new RedisIndexedSessionRepository(redis);
        repo.setDefaultMaxInactiveInterval(Duration.ofMinutes(30));
        
        // 关键：配置 Redis key 前缀，方便管理
        repo.setRedisKeyNamespace("myapp:session:");
        
        return repo;
    }
}

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketSecurityConfig implements WebSocketMessageBrokerConfigurer {

    @Override
    public void configureClientInboundChannel(ChannelRegistration registration) {
        registration.interceptors(new ChannelInterceptor() {
            @Override
            public Message<?> preSend(Message<?> message, MessageChannel channel) {
                StompHeaderAccessor accessor = 
                    MessageHeaderAccessor.getAccessor(message, StompHeaderAccessor.class);
                
                if (StompCommand.CONNECT.equals(accessor.getCommand())) {
                    // 从 STOMP CONNECT 帧中提取 Token
                    String token = accessor.getFirstNativeHeader("Authorization");
                    if (token == null || !token.startsWith("Bearer ")) {
                        throw new AccessDeniedException("未认证");
                    }
                    
                    // 验证 Token 并设置用户
                    User user = tokenService.validateAndGetUser(token.substring(7));
                    accessor.setUser(user);
                }
                
                // 对于 SUBSCRIBE/SEND 等命令，检查权限
                if (StompCommand.SUBSCRIBE.equals(accessor.getCommand())) {
                    String destination = accessor.getDestination();
                    User user = (User) accessor.getUser();
                    
                    // 检查用户是否有权限订阅此主题
                    if (destination.startsWith("/topic/admin/") 
                        && !user.hasRole("ADMIN")) {
                        throw new AccessDeniedException("无权限订阅此主题");
                    }
                }
                
                return message;
            }
        });
    }
}

// ❌ Filter 用 getRequestURI() 做白名单 → 可被分号绕过
String uri = request.getRequestURI();
if (uri.endsWith(".js") || uri.endsWith(".css")) {
    chain.doFilter(request, response);
    return;
}
// GET /admin/deleteUser;.js → getRequestURI() 匹配 .js → 放行
// Tomcat 解析分号 → 路由到 /admin/deleteUser → 鉴权绕过

// ✅ 修复
String path = request.getServletPath();
// 或 Spring 路由属性
String pattern = (String) request.getAttribute(
    HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE);

// ❌ 无归属校验
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId) {
    return orderService.findById(orderId);
}

// ✅ 校验归属
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId, @AuthenticationPrincipal UserDetails user) {
    Order order = orderService.findById(orderId);
    if (!order.getUserId().equals(user.getId())) {
        throw new AccessDeniedException("无权访问");
    }
    return order;
}

// ❌ 问题代码
@Override
public boolean preHandle(HttpServletRequest request, ...) {
    String uri = request.getRequestURI();
    if (uri.contains("/login") || uri.endsWith(".js")) { return true; }
    
    String token = request.getHeader("Authorization");
    if (token == null) { response.setStatus(401); return false; }
    
    User user = parseToken(token);
    if (user == null) { response.setStatus(401); return false; }
    
    return true;  // ← 任何登录用户都能访问管理接口！
}

// ✅ 使用 getServletPath() + 精确白名单 + 认证+授权
public boolean preHandle(HttpServletRequest request, ...) {
    String path = request.getServletPath();
    if (WHITELIST.contains(path)) { return true; }
    
    // 认证
    User user = tokenService.validateAndGetUser(request.getHeader("Authorization"));
    if (user == null) { response.setStatus(401); return false; }
    
    // 授权 — 必须有！
    if (path.startsWith("/api/admin/") && !user.hasRole("ADMIN")) {
        response.setStatus(403); return false;
    }
    
    request.setAttribute("currentUser", user);
    return true;
}

// 该系统的 AuthInterceptor 代码
if (request.getRequestURI().endsWith(".js") 
    || request.getRequestURI().endsWith(".css")) {
    return true;  // 静态资源直接放行
}
// ... 后续的认证逻辑永远走不到

// ❌ 危险：同时接受多种算法
@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder
        .withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
        .jwsAlgorithms(algs -> {
            algs.add(JWSAlgorithm.RS256);
            algs.add(JWSAlgorithm.HS256);   // ← 危险！
        })
        .build();
}

// ✅ 正确：只接受单一算法
@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder
        .withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
        .jwsAlgorithm(JWSAlgorithm.RS256)
        .build();
}

// ❌ parseClaimsJwt 不验证签名！
Claims claims = Jwts.parser().parseClaimsJwt(token).getBody();

// ✅ parseClaimsJws 强制验证签名
Claims claims = Jwts.parser()
    .setSigningKey(secretKey)
    .parseClaimsJws(token)  // ← 带 's'
    .getBody();

// ❌ catch 范围过大，掩盖 UnsupportedJwtException
public boolean validateToken(String token) {
    try {
        Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
        return true;
    } catch (Exception e) {  // ← 太宽泛
        return false;
    }
}

// ❌ 弱密钥 / 硬编码
String secret = "mySecretKey";  // 太短
String secret = "abc123def456ghi789jkl012mno345pq";  // 硬编码

// ✅ 正确做法
Key key = Keys.secretKeyFor(SignatureAlgorithm.HS256);  // 自动生成 256 位
// 或从 Vault/KMS 安全存储读取

String token = Jwts.builder()
    .setSubject(userId)
    .setIssuer("https://auth.example.com")
    .setAudience("api.example.com")
    .setIssuedAt(new Date())
    .setExpiration(new Date(System.currentTimeMillis() + 900_000))  // 15分钟
    .signWith(privateKey, SignatureAlgorithm.RS256)
    .compact();

Jws<Claims> jws = Jwts.parserBuilder()
    .setSigningKey(publicKey)
    .requireIssuer("https://auth.example.com")
    .requireAudience("api.example.com")
    .build()
    .parseClaimsJws(token);

@Component
public class JwtTokenValidator {
    private final SecretKey secretKey;
    private final RedisTemplate<String, String> redis;

    public Claims validateAndParse(String token) {
        String tokenId = extractTokenId(token);
        if (Boolean.TRUE.equals(redis.hasKey("token:revoked:" + tokenId))) {
            throw new SecurityException("Token revoked");
        }

        return Jwts.parserBuilder()
            .setSigningKey(secretKey)
            .requireIssuer("auth.example.com")
            .requireAudience("api.example.com")
            .setAllowedClockSkewSeconds(30)
            .build()
            .parseClaimsJws(token)  // ← parseClaimsJws!
            .getBody();
    }
}

// ✅ JWE 加密 Token — 内容不可见
public String generateEncryptedToken(User user) throws Exception {
    // 1. 构建 JWT Claims
    JWTClaimsSet claims = new JWTClaimsSet.Builder()
        .subject(user.getId().toString())
        .claim("role", user.getRole())
        .issueTime(new Date())
        .expirationTime(new Date(System.currentTimeMillis() + 900_000))
        .build();

    // 2. 创建 JWE 头部
    JWEHeader header = new JWEHeader(
        JWEAlgorithm.RSA_OAEP_256,   // 密钥加密算法
        EncryptionMethod.A256GCM     // 内容加密算法
    );

    // 3. 加密
    EncryptedJWT jwt = new EncryptedJWT(header, claims);
    RSAEncrypter encrypter = new RSAEncrypter(publicKey);
    jwt.encrypt(encrypter);

    return jwt.serialize();
}

// 解密
public Claims decryptAndValidate(String encryptedToken) throws Exception {
    EncryptedJWT jwt = EncryptedJWT.parse(encryptedToken);
    RSADecrypter decrypter = new RSADecrypter(privateKey);
    jwt.decrypt(decrypter);
    
    // 然后再做常规 JWT 校验
    return jwt.getJWTClaimsSet();
}

@Service
public class TokenRotationService {

    @Autowired
    private RedisTemplate<String, String> redis;

    // Access Token: 15 分钟
    private static final Duration ACCESS_EXPIRY = Duration.ofMinutes(15);
    // Refresh Token: 7 天
    private static final Duration REFRESH_EXPIRY = Duration.ofDays(7);
    // Refresh Token 家族前缀，用于检测重用
    private static final String TOKEN_FAMILY = "token:family:";

    public TokenPair issueTokens(String userId) {
        String familyId = UUID.randomUUID().toString();
        String refreshId = UUID.randomUUID().toString();

        // 存储 refresh token 家族
        redis.opsForValue().set(TOKEN_FAMILY + familyId, refreshId, REFRESH_EXPIRY);

        String accessToken = generateAccessToken(userId, familyId);
        String refreshToken = generateRefreshToken(userId, familyId, refreshId);

        return new TokenPair(accessToken, refreshToken);
    }

    public TokenPair rotateTokens(String oldRefreshToken) {
        Claims claims = validateRefreshToken(oldRefreshToken);
        String familyId = claims.get("familyId", String.class);
        String oldRefreshId = claims.get("refreshId", String.class);

        // 检查 refresh token 是否已被使用（检测重用 → 说明被盗）
        String storedRefreshId = redis.opsForValue().get(TOKEN_FAMILY + familyId);
        if (storedRefreshId == null || !storedRefreshId.equals(oldRefreshId)) {
            // Refresh Token 重用！可能是被盗。
            // 立即吊销整个家族
            redis.delete(TOKEN_FAMILY + familyId);
            redis.opsForValue().set("token:family:revoked:" + familyId, "1", Duration.ofDays(7));
            
            // 强制用户重新登录，并发出告警
            log.warn("Refresh Token 重用检测：familyId={}", familyId);
            throw new SecurityException("Token 已被使用，请重新登录");
        }

        // 正常轮换：换发新的 refresh token
        String newRefreshId = UUID.randomUUID().toString();
        redis.opsForValue().set(TOKEN_FAMILY + familyId, newRefreshId, REFRESH_EXPIRY);

        String newAccessToken = generateAccessToken(claims.getSubject(), familyId);
        String newRefreshToken = generateRefreshToken(claims.getSubject(), familyId, newRefreshId);

        return new TokenPair(newAccessToken, newRefreshToken);
    }

    public void revokeFamily(String familyId) {
        redis.delete(TOKEN_FAMILY + familyId);
    }
}

// 签发 Token 时绑定客户端指纹
public String issueBoundToken(User user, HttpServletRequest request) {
    String fingerprint = generateFingerprint(request);
    
    return Jwts.builder()
        .setSubject(user.getId().toString())
        .claim("fp_hash", sha256(fingerprint))  // 指纹哈希存入 Token
        .setExpiration(new Date(System.currentTimeMillis() + 900_000))
        .signWith(privateKey, SignatureAlgorithm.RS256)
        .compact();
}

// 验证时比对指纹
public Claims validateBoundToken(String token, HttpServletRequest request) {
    Claims claims = validateAndParse(token);
    String currentFp = sha256(generateFingerprint(request));
    String storedFp = claims.get("fp_hash", String.class);
    
    if (!currentFp.equals(storedFp)) {
        throw new SecurityException("Token 客户端指纹不匹配");
    }
    return claims;
}

// 生成客户端指纹（IP + UA 组合）
private String generateFingerprint(HttpServletRequest request) {
    String ip = request.getHeader("X-Forwarded-For");
    if (ip == null) ip = request.getRemoteAddr();
    String ua = request.getHeader("User-Agent");
    return ip + "|" + ua;
}

// Shiro 1.2.4 源码 — 全网公开的硬编码密钥
private static final byte[] DEFAULT_CIPHER_KEY_BYTES = 
    Base64.decode("kPH+bIxk5D2deZiIxcaaaA==");

// Java Config — 使用随机强密钥
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager manager = new CookieRememberMeManager();
    KeyGenerator keyGen = KeyGenerator.getInstance("AES");
    keyGen.init(256);
    manager.setCipherKey(keyGen.generateKey().getEncoded());
    return manager;
}

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean factory = new ShiroFilterFactoryBean();
        factory.setSecurityManager(securityManager);
        factory.setLoginUrl("/login");
        factory.setUnauthorizedUrl("/403");

        // 过滤器链 — 顺序敏感，精细在前
        Map<String, String> filterChain = new LinkedHashMap<>();
        filterChain.put("/login", "anon");
        filterChain.put("/api/public/**", "anon");
        filterChain.put("/api/admin/**", "authc,roles[admin]");
        filterChain.put("/api/user/**", "authc");
        filterChain.put("/**", "authc");
        factory.setFilterChainDefinitionMap(filterChain);
        return factory;
    }

    @Bean
    public DefaultWebSecurityManager securityManager(MyRealm realm) {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(realm);
        // 关键：禁用或加固 rememberMe
        manager.setRememberMeManager(null);
        return manager;
    }

    @Bean
    public MyRealm myRealm() {
        MyRealm realm = new MyRealm();
        realm.setCredentialsMatcher(hashedCredentialsMatcher());
        return realm;
    }

    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher() {
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        matcher.setHashAlgorithmName("SHA-256");
        matcher.setHashIterations(1024);
        matcher.setStoredCredentialsHexEncoded(true);
        return matcher;
    }
}

public class MyRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;
    @Autowired
    private PermissionService permissionService;

    // 认证：验证用户名密码
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) throws AuthenticationException {
        
        String username = (String) token.getPrincipal();
        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UnknownAccountException("用户不存在");
        }
        if (!user.isEnabled()) {
            throw new LockedAccountException("账号已禁用");
        }
        
        // 返回认证信息，Shiro 自动校验密码
        return new SimpleAuthenticationInfo(
            user,                    // principal
            user.getPassword(),      // hashed password
            ByteSource.Util.bytes(user.getSalt()),
            getName()                // realm name
        );
    }

    // 授权：加载用户权限和角色
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principals) {
        
        User user = (User) principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        
        // 角色
        Set<String> roles = userService.getRoles(user.getId());
        info.setRoles(roles);
        
        // 权限字符串
        Set<String> permissions = permissionService.getPermissions(user.getId());
        info.setStringPermissions(permissions);
        
        return info;
    }
}

@RestController
@RequestMapping("/api/admin")
public class AdminController {

    @RequiresRoles("admin")
    @GetMapping("/users")
    public List<User> getUsers() { }

    @RequiresPermissions("circle:admin:delete")
    @DeleteMapping("/circle/{id}")
    public void deleteCircle(@PathVariable Long id) { }
}

// 方法一：全局配置
JSON.DEFAULT_GENERATE_FEATURE |= SerializerFeature.WriteClassName.mask;
ParserConfig.getGlobalInstance().setSafeMode(true);

// 方法二：通过系统属性配置（推荐，无需修改代码）
// 在JVM启动参数中添加：-Dfastjson.parser.safeMode=true

// 方法三：通过fastjson.properties文件配置
// 在classpath下创建fastjson.properties文件，内容为：
// fastjson.parser.safeMode=true

// 方法一：全局禁用（推荐，如果业务不需要AutoType）
ParserConfig.getGlobalInstance().setAutoTypeSupport(false);

// 方法二：针对单个Parser禁用（Fastjson >= 1.2.68 支持 SafeMode）
ParserConfig config = new ParserConfig();
config.setSafeMode(true);
JSON.parseObject(jsonStr, TargetClass.class, config);

// 假设com.example.User是允许反序列化的类
ParserConfig.getGlobalInstance().addAccept("com.example.User");
// 或者通过系统属性：-Dfastjson.parser.autoTypeAccept=com.example.User,com.example.Product

// 正确：使用预编译语句（PreparedStatement）
String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = conn.prepareStatement(sql);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();